Support CORS use cases without the need to proxy requests

[day0ops]

Gloo Edge Product

Enterprise

Gloo Edge Version

1.17

Is your feature request related to a problem? Please describe.

Background:
Right now CORS can only be applied to direct responses and proxied requests (in other words has a valid backend service to send the request to).

Natively Envoy ignores CORS filter when combined with direct responses due to the nature of the filter ordering.

In Gloo Gateway, we have worked around the lack of support by sending the CORS headers whenever a direct response is applied as the destination. This however, by passes the CORS filter in Envoy hence it has limitations. Refer to the implementation here for further details. This implementation works as long as the origin domain is single but when multiple domains are provided this would lead to,

The 'Access-Control-Allow-Origin' header contains multiple values .... , but only one is allowed. Have the server send the header with a valid value, or, if an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

An example VS of this includes,

       options:
          cors:
            allowOrigin:
              - https://apps.demo.example.com
              - https://apps-test.example.com

The main user requirement is to be able to send static responses with CORS.

Describe the solution you'd like

Regardless of the request type (simple or pre-flight) we need to automatically determine the origin of the request and the CORS headers appropriately.

Describe alternatives you've considered

Similar to direct responses we can wire up a blackhole cluster (not a true destination) to apply the filter chain. GraphQL implementation attempted to solve this with a blackhole cluster in a similar way.

Additional Context

No response